Implementing a Secure Notebook Execution with Least-Privilege Mode

The JupyterHub service and Notebook Execution service run notebook kernels under dedicated Windows accounts. These kernels restrict and isolate notebook code from sensitive system resources.

Under least-privilege mode, each notebook kernel enforces the following behaviors:

  • Disables the ability to read sensitive configurations or sensitive data.
  • Disables the ability to write to the Skyline Data directory.
  • Disables the ability to install Python packages into shared locations.
  • Disables the ability to execute privileged operations such as Restart-Computer or Stop-Service.

Notebook kernels use low-privilege local user accounts. These user accounts are members of the SystemLinkNotebooks group and the Users group. These accounts are not visible from the Windows login screen. SystemLink grants each account the Log on as a service permission.

Name Type Purpose
SystemLinkNotebooks Local group The group that grants the shared set of ACLs applied by the provisioning tool. To allow notebook accounts to access other directories, add this group to that directory.
SystemLinkJupyterHub Local user The user account for interactive Jupyter notebook sessions.
SystemLinkNotebookEx Local user The user account for the Notebook Execution service. This service programmatically runs the notebooks.

The Notebook Execution service runs notebooks as the SystemLinkNotebookEx user. The service also uses this account to programmatically execute notebooks. For notebooks that require reading or writing files to the local file system, refer to Relaxing Permissions for Least-Privilege Mode.

Note The TDM User Account requires local administrator rights. For security reasons, do not use this account for notebook execution.